Claude Code's 'Don't Ask Again' Saved the Password Too, and Apiiro Counted Them on GitHub

On November 5, 2026, the security company Apiiro published a count of a problem users had reported since August 2025. When a developer chooses "Yes, and don't ask again" for a shell command in Claude Code, the exact command becomes an allow rule in .claude/settings.local.json. If the command contained a password, so does the rule.

What Apiiro counted

Scale. GitHub holds 104,185 public copies of that file, and 1,122 (1.1 percent) hold what Apiiro classes as a real secret, for 1,379 distinct values. Adding file history, shared settings and agent transcripts brings the total to 2,539 distinct secrets in 1,994 repositories.
Type. More than a third open a database directly: 379 database passwords and 122 Supabase service-role keys. There are also 43 SSH logins, 42 GitHub, GitLab and npm tokens, and 23 AWS keys.
Organizations. Apiiro identifies 63, including a database vendor with an admin-level cloud key. It says one confirmed that its exposed key had been live.
Scanners. Of the 1,122 files, gitleaks flagged 564 and TruffleHog 643, and 215 were flagged by neither. A password after PGPASSWORD= or sshpass -p has no recognisable key format.
Deletion does not help. Earlier versions of the file hold 734 secrets in 509 repositories that appear in no current copy.

Whose fault the commit is

The mechanism is documented, and Apiiro is careful about it: when Claude Code creates the file inside a Git repository it adds it to the developer's global ignore list. That protection, Apiiro says, does not cover a folder that becomes a repository later, a clone on another machine, or a file someone has already committed. The rule never goes into the repository's own .gitignore.

Boris Cherny of the Claude Code team replied on Hacker News on November 7 that the file "is meant to stay local" and that "We automatically gitignore it when Claude creates the file, so in this case the files were manually created and checked in". He added that "we are looking into what we can do to prevent this", and that basic secret scanning is among the options. Apiiro's data complicates the first claim, since in 539 of the 1,105 repositories it traced, a commit co-authored by Claude changed the file. As iTWire points out, that does not establish that Claude introduced every exposed credential.

What remains uncertain. Apiiro says plainly that "No credential was used or tested", so a "real secret" means a value matching a provider format or a public host, not one known to work. The classification used an LLM reviewer. Apiiro sells security products, and no outside party has replicated the totals. The earliest issue, #5544 from August 2025, was closed by a GitHub Actions bot on January 3, 2026, marked as not planned.

Analysis: Rotate first, because deleting a file leaves it in history, forks and clones. Then add the path to each repository's own .gitignore, approve patterns rather than literal commands, and reference secrets as environment variables so the rule records the name and not the value. Tanishka's team at Belgavi's Book Store should scan .claude/ and any saved transcripts for passwords inside command lines, since a format-based scanner will miss those.

Sources and evidence

Apiiro found real-looking secrets in 1,122 of 104,185 public Claude Code local settings files, and 2,539 across history, shared settings and transcripts. It tested none and sells security products. The Claude Code lead says the files are auto-ignored and were checked in manually; Apiiro traced Claude co-authored commits in 539 of 1,105 repositories. Rotate first, then ignore the file in each repo.